The empirical success of existing defenses seemingly diminish the threat of gradient inversion in FL, especially since gradient compression [1]}, [2]} is already commonplace in practical FL applications to reduce communication cost. However, we argue that optimization-based attacks underestimate the power of the adversary: If the adversary has access to an auxiliary dataset \(\mathcal {D}_{\rm aux}\) , they can train a gradient inversion model to recover \(\mathcal {D}_{\rm aux}\)  from its gradients computed on the global model.
As we will establish later, this greatly empowers the adversary, exposing existing risks to federate learning.
